CVE-2026-57997
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance of HS384 and HS512 tokens alongside HS256. Attackers possessing the jwtSecret can mint tokens with non-standard HMAC variants to bypass algorithm restrictions and weaken authentication controls.
Risk Assessment
The organization is at risk of unauthorized access to the Strapi system via forged JWT tokens, potentially leading to account takeover and privilege escalation.
Recommendation
Explicitly configure the plugin::users-permissions.jwt.algorithm parameter to a secure algorithm (e.g., RS256) and update the users-permissions plugin to the latest patched version.
Other vulnerabilities in Strapi
See all- CVE-2026-27886High
Strapi is an open-source content management system that in versions from 4.0.0 to prior to 5.37.0 did not sufficiently sanitize query parameters when filtering content via relational fields. An unauthenticated attacker could use the `where` query parameter to perform a boolean-oracle attack against private fields in the `admin_users` table, allowing for administrative account takeover.
- CVE-2023-22894MediumActively exploited
Strapi through 4.5.5 allows attackers with admin panel access to discover sensitive user details by exploiting the query filter. Attackers can filter users by columns containing sensitive information and infer values from API responses. Super admin can discover password hashes and password reset tokens of all users.
- CVE-2026-108114Medium
Strapi versions 5.47.0 through 5.57.0 contain an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields, token holders can keep reading content fields an administrator removed from the role.
- CVE-2026-90561High
Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an Editor or Super Admin's session when the preview pane is expanded, enabling account takeover.
- CVE-2023-34235High
Strapi, an open-source content management system, prior to version 4.10.8, allows leaking private fields when using the `t(number)` prefix. Changing the prefix in Knex queries can expose protected data such as admin passwords.
- CVE-2023-34093Medium
Strapi, an open-source content management system, prior to version 4.10.8 allowed anyone to make content-type attributes public without realizing it. This vulnerability could lead to sensitive information being exposed as users might unknowingly remove the privateAttributes protection mechanism.
- CVE-2022-32114High
An unrestricted file upload vulnerability in Strapi 4.1.12's Add New Assets function allows XSS attacks via a crafted PDF file. The project documentation notes that users with Media Library upload permissions can upload PDFs containing JavaScript, and all files in the public assets folder are externally accessible.
Original NVD description (English source)
Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance of HS384 and HS512 tokens alongside HS256. Attackers possessing the jwtSecret can mint tokens with non-standard HMAC variants to bypass algorithm restrictions and weaken authentication controls.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS